Tag: programming
-
AI development pipeline attacks expand CISOs’ software supply chain risk
Tags: access, ai, api, application-security, attack, backdoor, breach, business, ciso, cloud, container, control, cyber, cybersecurity, data, data-breach, detection, encryption, exploit, flaw, fortinet, government, infrastructure, injection, intelligence, LLM, malicious, malware, ml, network, open-source, password, penetration-testing, programming, pypi, risk, risk-assessment, russia, saas, sbom, service, software, supply-chain, threat, tool, training, vpn, vulnerabilitydevelopment pipelines are exacerbating software supply chain security problems.Incidents of exposed development secrets via publicly accessible, open-source packages rose 12% last year compared to 2023, according to ReversingLabs (RL).A scan of 30 of the most popular open-source packages found an average of six critical-severity and 33 high-severity flaws per package.Commercial software packages are also a…
-
Ebyte Ransomware Targets Windows Users with Advanced Encryption Techniques
A new ransomware variant, known as Ebyte Ransomware, has emerged as a significant threat to Windows users. Developed in the Go programming language, this ransomware employs sophisticated encryption techniques, including ChaCha20 and Elliptic Curve Integrated Encryption Scheme (ECIES), to lock user files and demand ransom payments. The ransomware, inspired by Prince Ransomware, adds a unique…
-
Companies are drowning in high-risk software security debt, and the breach outlook is getting worse
Flaw prevalence: Leading organizations have flaws in fewer than 43% of applications, while lagging organizations exceed 86%.Fix capacity: Leaders resolve over 10% of flaws monthly, whereas laggards address less than 1%.Fix speed: Top performers remediate half of flaws in five weeks; lower-performing organizations take longer than a year.Security debt prevalence: Less than 17% of applications…
-
Secrets Detection Beyond the Repository: Securing The EndEnd Software Development Factory
Imagine this: A developer, pressed for time, drops an AWS access key into a Slack channel, asking a teammate for help debugging a production issue. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/secrets-detection-beyond-the-repository-securing-the-end-to-end-software-development-factory/
-
NHS investigating how API flaw exposed patient data
NHS patient data was left vulnerable by a flaw in an application programming interface used at online healthcare provider Medefer First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366620174/NHS-investigating-how-API-flaw-exposed-patient-data
-
Role of AutoSecT in API Pentesting
APIs (Application Programming Interfaces) have become the backbone of modern software, enabling seamless communication between applications and services with efficiency and simplicity. As APIs play an increasingly vital role in today’s digital ecosystem, ensuring their security is more critical than ever. A key aspect of the Software Development Life Cycle (SDLC) is API Pentesting. This……
-
C++ creator calls for help to defend programming language from ‘serious attacks’
Bjarne Stroustrup says standards committee needs to show it can respond to memory safety push First seen on theregister.com Jump to article: www.theregister.com/2025/03/02/c_creator_calls_for_action/
-
Almost All Organisations Experienced API Security Issues in Past Year
The latest State of API Security Report by Salt Security has highlighted the ongoing challenges faced by organisations in securing their application programming interfaces (APIs). The Salt Labs State of API Security Report Q1 2025 draws on survey responses from over 200 IT and security professionals, alongside anonymised data from Salt Security’s customer base, to…
-
Is Vibe Coding The Future of Software Development
Digital Technology is evolving faster than ever, and the way we interact with it is transforming dramatically. With the rise of AI-driven development, no-code/low-code platforms,…Read More First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/02/is-vibe-coding-the-future-of-software-development/
-
GPT-4o Copilot Covers More Than 30 Popular Programming Languages
GitHub has launchedGPT-4o Copilot, a refined code completion model now available to Visual Studio Code users. Built on the GPT-4o mini architecture and trained on over 275,000 high-quality public repositories, the update marks a leap in multi-language support, performance accuracy, and contextual understanding across more than 30 popular programming languages, including Python, JavaScript, Rust, Go, and TypeScript. Expanded Language…
-
CISA and FBI Warn Against Buffer Overflow Vulnerabilities
US agencies have issued a new alert to eliminate buffer overflow vulnerabilities, urging memory-safe programming for secure-by-design software development First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-fbi-buffer-overflow/
-
Docker Inc. CEO swap has analysts anticipating a sale
Industry watchers see the takeover by a former Oracle exec as the precursor to merging with a broader software development portfolio at a larger company. First seen on techtarget.com Jump to article: www.techtarget.com/searchsoftwarequality/news/366619297/Docker-Inc-CEO-swap-has-analysts-anticipating-a-sale
-
GitHub Copilot’s New Agent Mode Enables Autonomous Code Completion
GitHub has once again raised the bar for productivity in software development with the launch of its revolutionary >>Agent Mode
-
Attackers hide malicious code in Hugging Face AI model Pickle files
Tags: ai, data, github, malicious, ml, open-source, programming, remote-code-execution, risk, service, software, threat, tool, vulnerabilityLike all repositories of open-source software in recent years, AI model hosting platform Hugging Face has been abused by attackers to upload trojanized projects and assets with the goal of infecting unsuspecting users. The latest technique observed by researchers involves intentionally broken but poisoned Python object serialization files called Pickle files.Often described as the GitHub…
-
Lazarus Group tricks job seekers on LinkedIn with crypto-stealer
North Korea-linked Lazarus Group is duping job seekers and professionals in an ongoing campaign that runs a LinkedIn recruiting scam to capture browser credentials, steal crypto wallet data, and launch persistence.According to a discovery made by BitDefender Labs, threat actors reach out with fake LinkedIn job offers to lure the victims into downloading and executing…
-
Go Module Mirror served backdoor to devs for 3+ years
Supply chain attack targets developers using the Go programming language. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/02/backdoored-package-in-go-mirror-site-went-unnoticed-for-3-years/
-
Crypto-stealing iOS, Android malware found on App Store, Google Play
A number of iOS and Android apps on Apple’s and Google’s official app stores contain a software development kit (SDK) that allows them to exfiltrate … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/05/crypto-stealing-ios-android-malware-found-on-app-store-google-play-sparkcat-malicious-sdk/
-
Poisoned Go programming language package lay undetected for 3 years
Tags: programmingResearcher says ecosystem’s auto-caching is a net positive but presents exploitable quirks First seen on theregister.com Jump to article: www.theregister.com/2025/02/04/golang_supply_chain_attack/
-
Why Some Source Code Files Shouldn’t Be Managed via Git-Based Version Control
The ubiquitous version control system, Git, has revolutionised software development workflows with its robust set of capabilities. It simplifies the tracking of code changes, enables seamless branching and merging, and facilitates tight collaboration. Today, more than 100 million developers worldwide use the GitHub platform alone. However, Git is not always a suitable solution for all…
-
Lazarus Group Exploits Trusted Apps for Data Theft via Dropbox
Tags: crypto, cyber, data, espionage, exploit, group, infrastructure, korea, lazarus, north-korea, programming, software, technology, theft, toolIn an alarming development, North Korea’s infamous Lazarus Group has been linked to a global cyber espionage campaign, code-named Operation Phantom Circuit. Beginning in September 2024, this operation exploited trusted software development tools to infiltrate systems worldwide, targeting cryptocurrency and technology developers. The campaign’s advanced obfuscation techniques and infrastructure demonstrate a significant evolution in the…
-
Empowering Teams with Secure API Management
Why is Secure API Management Essential for Team Empowerment? Is API management a critical aspect of your organization’s cybersecurity strategy? It should be. APIs, or Application Programming Interfaces, are the engines that power today’s digital ecosystem. They enable systems to communicate, allowing for streamlined operations and improved productivity. However, incorrectly managed APIs expose businesses to……